Decision
Mr. X and Department of Justice, Home Affairs and Migration
From Office of the Information Commissioner (OIC)
Case number: OIC-159154-X0F7H0
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-159154-X0F7H0
Published on
Whether the Department was justified in refusing access to records concerning the Communications (Retention of Data) Act 2011
6 May 2026
Speaking generally, the Communications (Retention of Data) Act 2011 (the 2011 Act) requires providers of electronic communications services to retain certain data relating to all users of their services, and to make this data available to An Garda Síochána and the Defence Forces for criminal justice and/or national security purposes in specific circumstances. It contains similar provisions regarding certain other competent authorities.
The 2011 Act gives effect to the EU Data Retention Directive (Directive 2006/24/EC) (the Directive), which was declared invalid by the Courts of Justice of the EU (CJEU) in 2014. The Supreme Court subsequently referred questions about the 2011 Act to the CJEU. In 2022, the CJEU confirmed that the general indiscriminate retention of metadata for the purposes of preventing serious crime is inconsistent with EU law. The 2011 Act was subsequently amended by the Communications (Retention of Data) Amendment Act 2022 (the 2022 Act).
By way of further overall context to this decision, the 2011 Act is designated as ‘security legislation’ further to section 229 of the Policing, Security, and Community Safety Act 2024. The operation of the 2011 Act is subject to oversight by the Independent Examiner of Security Legislation (the Independent Examiner) since 2024. Prior to 2024, oversight rested with a Designated Judge, one of whose duties was to make a report to the Taoiseach on matters relating to the 2011 Act.
On 26 February 2025, the applicant made an FOI request to the Department for the following:
1. Agendas and minutes of meetings since 1 July 2024 which relate to the 2011 Act.
2. All reports received by the Minister under section 9 of the 2011 Act for 2023 and 2024.
3. Any documents, notes, reports or memos produced in relation to the 2011 Act or its intended revision, since 1 July 2024.
4. All correspondence received by the Department since 1 January 2024 from Three Ireland, Vodafone and eir in relation to the 2011 Act.
5. Any data produced for or provided to Minister O’Callaghan in relation to the 2011 Act.
The applicant said that references to the 2011 Act included references to the 2022 Act and any connected SIs or other amendments, in draft or otherwise. He further clarified that part 3 could be confined to information related to law enforcement’s retrospective access to Schedule Two data, or any intentions around this.
The Department’s decision of 7 April 2025 covered 18 records, of which it released record 13 in full. It released records 6 and 7 subject to the redaction of details under section 37 of the FOI Act (personal information). It refused access to the remaining records, apparently under sections 32(1)(a)(i), 32(1)(a)(ii), 32(1)(a)(iii), 32(1)(b) and 32(1)(c) of the FOI Act. Generally speaking, section 32 is concerned with law enforcement and public safety.
On 7 April 2025, the applicant sought an internal review of the Department’s decision. On 16 May 2025, the Department granted partial access to record 12 and affirmed its decision on the remainder. It also sought to rely on section 29 of the FOI Act (deliberative processes).
On 22 May 2025, the applicant applied to this Office for a review of the Department’s decision.
On 18 June 2025, this Office issued a notice to the Department under section 23 of the FOI Act, requiring it to give adequate reasons for its decision on the request. On 8 July 2025, the Department provided the applicant and this Office with reasons for its reliance on sections 29, 32(1)(a)(i) (investigation of offences) and 37 of the FOI Act. It subsequently granted partial access to records 1, 4 and 5, further access to record 12 and full access to records 8-10. It also sought to rely on further provisions of the FOI Act, to which I do not need to refer given my decision as set out below.
I have explained to the applicant why I consider sections 32(1)(a)(iii) (procedures for ensuring safety of persons) and 37 of the FOI Act to apply to the names and other brief details that have been withheld from records 6, 7 and 12. I also explained why I consider section 42(b)(x) (non-application of FOI Act to records held or created by An Garda Síochána (AGS) that relate to the 2011 Act) to apply to records 2 and 16. The applicant has confirmed that I need not consider these records further.
I have now completed my review in accordance with section 22(2) of the FOI Act and I have decided to conclude it by way of a formal, binding decision. In carrying out my review, I have had regard to the above exchanges, correspondence between this Office, the Department, Fiosrú (formerly the Garda Síochána Ombudsman Commission (GSOC)), the Defence Forces and the applicant, the contents of the records at issue and the provisions of the FOI Act. References to Fiosrú from this point onwards may be taken as references to GSOC, as appropriate.
The details withheld at this point are the remainder of records 1, 4 and 5 and records 3, 11, 14, 15, 17 and 18 in full. This review is confined to the sole issue of whether the Department’s refusal to grant access to these records or parts of records was justified under the FOI Act.
The review is considered to be de novo, i.e. it is based on the circumstances and the law as they pertain at the time of the decision.
Sections 13(2)(d) and 21(5)(c) of the FOI Act require that, where an FOI body decides to refuse to grant a request, the notification of the decision shall specify various matters, including the reasons for the refusal, the findings on any material issues relevant to the decision and particulars of any matter relating to the public interest taken into consideration.
The Department’s original decision quotes the wording of various provisions of section 32 of the FOI Act but does not explain why it considers them to apply. I note that the internal review application asked the Department to clarify this matter. However, the internal review decision gives no further explanation. Furthermore, in relation to section 29, it says only that “parts of the record … are part of the deliberative process.“ It gives no information about the deliberative process concerned and does not address the public interest. Accordingly, and as described above, this Office considered it appropriate to issue a notice to the Department under section 23 of the FOI Act in relation to its decisions.
Having been subject to FOI since 1998, the Department should be well aware of the various requirements of sections 13 and 21 of the FOI Act. It should ensure that its future decisions contain all relevant information, and it should also have regard to the guidance for FOI bodies that is available on the website of the Department for Public Expenditure, NDP Delivery and Reform's Central Policy Unit (CPU) at foi.gov.ie. In addition, the Minister for Public Expenditure, NDP Delivery and Reform has published a Code of Practice (the Code) for public bodies pursuant to section 48 of the Act, which is also available on the CPU's website. The Code includes key details relevant to the processing of requests and the contents of decisions. Under section 48(3) of the FOI Act, public bodies must have regard to the Code in the performance of their functions under the Act.
Section 18(1) provides, that "if it is practicable to do so", access to an otherwise exempt record shall be granted by preparing a copy, in such form as the head of the public body concerned considers appropriate, of the record with the exempt information removed. Section 18(1) does not apply, however, if the copy provided for thereby would be misleading (section 18(2) refers). It should be noted that the Commissioner takes the view that, generally, neither the definition of a record nor the provisions of section 18 envisage or require the extracting of particular sentences or occasional paragraphs from the remainder of a record for the purpose of granting access to those particular sentences or paragraphs.
Although I am obliged to give reasons for my decision, section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record. This means that the extent to which I can describe the details at issue and elements of the arguments made is somewhat limited.
Release of records under FOI is generally understood to have the same effect as publishing them to the world at large, given that the Act places no constraints on the uses to which the information contained in those records may be put.
I will firstly address records 3-5. Record 3 was created by the Defence Forces and contains statistical information about its use of the 2011 Act. Records 4 and 5 were created by Fiosrú and contain the same type of information.
The Department considers the now-excluded record 2 and records 3-5 relevant to part 2 of the FOI request, which sought access to reports received by the Minister under section 9 of the 2011 Act. Speaking very generally, section 9 of the 2011 Act requires the various competent authorities to report to their Ministers on their usage of that Act. The Ministers are required to review such reports. They are also required to forward the reports, with any comments they may have on their contents, to the Minister for Justice, Home Affairs and Migration. A consolidated State report is then required to be made to the European Commission (the Commission).
I understand from the Department that while the ultimate purpose of section 9 was to comply with the Directive’s requirement for reports to be made to the Commission, such reports are no longer necessary since the Directive was struck down by the CJEU. However, as noted already, the Designated Judge (now the Independent Examiner) has oversight of the 2011 Act and is required to publish an annual report on the matter. I understand that the Designated Judge’s contacts with the various competent authorities were routed through the Department and that this is why the Department holds records 2-5.
Record 3
The Defence Forces claim that record 3 is not subject to the FOI Act further to the provisions of section 42(c)(ii)(VI) of the FOI Act.
Section 42(c)(ii)(VI) – restriction of FOI Act
Generally speaking, section 42 of the FOI Act provides that certain types of records are not subject to FOI. For instance, as mentioned earlier, section 42(b)(x) provides that the FOI Act does not apply to records held or created by AGS that relate to the 2011 Act. In addition, section 42(c)(ii)(VI) provides that the FOI Act does not apply to records held by the Defence Forces relating to the 2011 Act.
While the Department’s initial submission sought to rely on section 42(c)(ii)(VI) in relation to record 3, I understand that it no longer considers the provision to be relevant. However, in seeking comment from the Defence Forces, I outlined why I disagreed with the Department’s then position on the matter. I explained that section 42(c)(ii)(VI) is concerned with records held by the Defence Forces rather than records created by it, as is the case with record 3.
The Defence Forces says that section 42(c)(ii)(VI) provides for an express statutory restriction from FOI of all records held by it relating to the 2011 Act. It says that the provision can only be intended to ensure that such records are not made available to the public. It says that I have taken an academic interpretation of the word “held” which, if taken to its logical conclusion, would effectively undo the clear intent of a statutory restriction. It says that this is not in line with the intent and spirit of the law.
The Defence Forces says that it provided record 3 to the Department for a distinct compliance purpose, at the request of the Designated Judge in the course of his oversight role. It says that, due to an anomaly that was not provided for in the 2014 Act, it is being deprived of its control of the record and the facility to refuse access to it. It says that this is patently unfair.
The Defence Forces also argues that it should be for the Independent Examiner to decide what, if any, records relating to the 2011 Act should be released. It notes that records held or created by the Independent Examiner are not subject to the FOI Act further to section 42(db) of the FOI Act.
This Office has no role in rectifying any apparent errors, oversights or anomalies in the FOI Act. Rather, I am required to apply the provisions of the FOI Act as they have been written and passed by the Oireachtas. Furthermore, while the Defence Forces may disagree, the FOI Act gives this Office the power to consider whether record 3 is subject to the FOI Act and, if so, whether it should be released.
I accept that the Defence Forces created record 3 and that it relates to the 2011 Act. While the record is not physically held by the Defence Forces, the latter appears to argue that I should deem this to be the case for the purposes of section 42(c)(ii)(VI) of the FOI Act.
I accept that section 42(c)(ii)(VI) would apply to the identical copy of record 3 that is in the Defence Forces’ own possession, and which is therefore held by it for the purposes of the FOI Act. However, any such copy has a different identity to record 3 which, as a matter of fact, is held by the Department for the purposes of the FOI Act. Unlike section 42(b)(x), section 42(c)(ii)(VI) applies only to records relating to the 2011 Act that are held by the Defence Forces. Further to all of the above, I find that section 42(c)(ii)(VI) does not apply to record 3.
This is not the end of the matter, however. The Defence Forces and the Department argue that, in any event, record 3 is exempt under various provisions of the FOI Act. While neither have cited the mandatory section 33(3)(c)(i), in my view it is appropriate to consider this provision in the particular circumstances of this case.
Section 33(3)(c)(i) - information communicated in confidence relating to security of the State
Section 33(3)(c)(i) of the FOI Act provides that an FOI body shall refuse to grant an FOI request if the record concerned contains information communicated in confidence to any person in or outside the State from any person in or outside the State (including any law enforcement agency) and relating to a matter referred to in subsection (1), or to the protection of human rights and expressed by the latter person to be confidential or to be communicated in confidence. It does not require the consideration of the public interest.
I brought the applicant’s attention to the potential relevance of section 33(3)(c)(i). I have received no arguments from him in response.
As noted, record 3 contains statistical information about the Defence Forces’ use of the 2011 Act. Both the Defence Forces and the Department say that it was provided to the Department, in confidence, for forwarding to the Designated Judge.
The 2011 Act, as amended, provides that the Defence Forces may seek disclosure and other orders on grounds relating to the security of the State. The matters referred to in section 33(1) of the FOI Act include “the security of the State”. In all of the circumstances, I am satisfied that record 3 consists of information communicated to a person in the State (the Designated Judge, via the Department) from a person in the State (the Defence Forces) and that it relates to a matter referred to in section 33(1) of the FOI Act.
The remaining question is whether the information was communicated in confidence. I understand that the Designated Judge is required to provide an annual report to the Taoiseach on competent authorities’ usage of the 2011 Act, and that the Taoiseach is required to publish this report. It could be argued that record 3 could not have been provided to the Designated Judge in confidence, given the publication requirement for the resulting annual report.
The Defence Forces contends that it provided record 3 to the Department in confidence, for the sole purpose of its onward transmission to the Designated Judge as part of his oversight role. Although not determinative, I note that the record is marked “RESTRICTED”. I note also the Department’s position that access to the record’s contents is confined to staff within its Security and Northern Ireland division.
The Designated Judge’s annual report is the released record 13. The Department says that this report is also publicly available on the Oireachtas website. In relevant part, record 13 gives an overview of the Defence Forces’ usage of the 2011 Act. Mindful of section 25(3), I am satisfied that the Designated Judge’s annual report reflects some, but not all, of the contents of record 3. However, the fact that some elements of the record may have lost their confidentiality does not, of itself, mean that the record was not communicated in confidence at the time it was provided to the Department. Furthermore, and while it did not happen in this instance, I understand that the Designated Judge’s annual report can itself be redacted before publication.
In all of the circumstances, it does not appear to me to be a foregone conclusion that all information provided by competent authorities to the Designated Judge for his oversight and annual report purposes will be published as a matter of course. In turn, I accept that the Defence Forces provided record 3 to the Department in confidence.
Further to all of the above, I find that section 33(3)(c)(i) applies to record 3.
In light of the above finding, there is no need for me to consider whether record 3 is exempt under the FOI provisions claimed by the Department and the Defence Forces. However, they should both note that section 33(2)(a) is not an exemption provision, but rather a list of records that may qualify for exemption under section 33(1) of the FOI Act.
Records 4 and 5
As noted, records 4 and 5 contain statistical information about Fiosrú’s use of the 2011 Act. Fiosrú confirms that it does not consider its functions to relate to any matter in section 33(1) of the Act.
The Department has granted partial access to the records, further to Fiosrú’s confirmation that it is agreeable to such release subject to the redaction of “In Reference to” numbers for ongoing cases. I understand that “In Reference to” numbers consist of case reference numbers specific to individual complaints. Fiosrú argues that these details are exempt under section 32(1)(a)(i) of the FOI Act.
Section 32(1)(a)(i) – prejudice to investigation of offences
Section 32(1)(a)(i) provides that a head may refuse to grant an FOI request if access to the record concerned could, in the opinion of the head, reasonably be expected to prejudice or impair the prevention, detection or investigation of offences, the apprehension or prosecution of offenders or the effectiveness of lawful methods, systems, plans or procedures employed for the purposes of the matters aforesaid. Where section 32(1)(a)(i) applies, the public interest test requires consideration only where certain limited circumstances exist (section 32(3)).
Generally speaking, section 32(1)(a) is a harm based exemption. Where an FOI body relies on this provision, it should identify the potential harm to the matters specified in the relevant sub-paragraph that might arise from disclosure. In relation to a claim under section 32(1)(a)(i), the FOI body should identify the relevant function or the relevant lawful methods, systems, plans or procedures. It should then describe the nature of the prejudice or impairment expected (the harm) and explain how release of the particular record is expected to cause that harm and why it is considered that the harm identified could reasonably be expected to occur.
I have already explained that section 25(3) of the FOI Act has implications for the extent to which I can describe Fiosrú’s explanation of why the redacted details are exempt.
I note that the details released from records 4 and 5 disclose the identities of mobile operators from which Fiosrú obtained information in the various ongoing cases. I note also that the records do not identify any complainants or AGS members the subject of the complaints concerned. However, I understand that when members are notified of complaints made about them, they are provided with the relevant “In Reference to” number.
In these circumstances, it is essentially Fiosrú’s position that disclosing the “In Reference to” numbers for open cases could provide AGS members under investigation with advance knowledge of matters relevant to those ongoing investigations. It says that this could hamper any potential interview strategy that might be employed by the Fiosrú investigator before a cautioned interview or statement. Its position is that such an outcome could reasonably be expected to prejudice and impair its investigation process.
I informed the applicant of Fiosrú’s arguments. I have not received any response from him on the matter.
As noted already, the disclosure of information under FOI effectively amounts to the disclosure of such information to the world at large. I have considered Fiosrú’s arguments, which as noted are more detailed than I can set out above. It seems to me that in all of the circumstances, disclosure of the details at issue could provide AGS members under investigation with advance knowledge that Fiosrú sought particular information under the 2011 Act relating to the complaints concerned. I accept that such an outcome could impair Fiosrú’s subsequent interviews and/or its investigation of those complaints. Accordingly, I am satisfied that disclosure of the withheld “In Reference to” numbers could reasonably be expected to prejudice Fiosrú’s ongoing investigation of the relevant open cases and/or the effectiveness of the methods it is using to investigate them. I find that the details are exempt under section 32(1)(a)(i) of the FOI Act.
Section 32(3) – the public interest
Further to section 32(3), I am required to consider the public interest in the disclosure of the withheld details if certain specified circumstances specified in paragraph (a)(i) or (a)(ii) exist. Those circumstances are as follows:
(ii) if the record discloses that an investigation for the purpose of the enforcement of any law, or anything done in the course of such an investigation or for the purposes of the prevention or detection of offences or the apprehension or prosecution of offenders, is not authorised by law or contravenes any law, or
(ii) contains information concerning—
(II) the performance of the functions of an FOI body whose functions include functions relating to the enforcement of law or the ensuring of the safety of the public (including the effectiveness and efficiency of such performance), or
(II) the merits or otherwise or the success or otherwise of any programme, scheme or policy of an FOI body for preventing, detecting or investigating contraventions of the law or the effectiveness or efficiency of the implementation of any such programme, scheme or policy by an FOI body.
I informed the applicant of the above. I have not received any response from him on the matter. Fiosrú does not address section 32(3). Of itself, this does not mean that I am required to consider the public interest, however. Having considered the records, I do not consider any of the above conditions to be met. Accordingly, I am not required to consider whether the relevant details should be disclosed in the public interest.
Records 1 (remainder), 11, 14, 15, 17 and 18
The Department relies on section 29 in relation to these records.
Section 29(1) provides that a head may refuse to grant an FOI request (a) if the record concerned contains matter relating to the deliberative processes of an FOI body (including opinions, advice, recommendations, and the results of consultations, considered by the body, the head of the body, or a member of the body or of the staff of the body for the purpose of those processes), and (b) the granting of the request would, in the opinion of the head, be contrary to the public interest, and, without prejudice to the generality of paragraph (b), the head shall, in determining whether to grant or refuse to grant the
request, consider whether the grant thereof would be contrary to the public interest by reason of the fact that the requester concerned would thereby become aware of a significant decision that the body proposes to make. These are two independent requirements and the fact that the first is met carries no presumption that the second is also met. It is therefore important for FOI bodies to show to the satisfaction of the Commissioner that both requirements have been met.
A deliberative process may be described as a thinking process which informs decision making in FOI bodies. It involves the gathering of information from a variety of sources and weighing or considering carefully all of the information and facts obtained with a view to making a decision or reflecting upon the reasons for or against a particular choice. Thus, it involves the consideration of various matters with a view to making a decision on a particular matter. It would, for example, include some weighing up or evaluation of competing options or the consideration of proposals or courses of action.
The public interest test at section 29(1)(b) is a stronger public interest test than the public interest test in many other sections of the Act (which require that, on balance, the public interest would be better served by granting than by refusing to grant the request). Any arguments against release should be supported by the facts of the case and it should be shown how release of the record(s) would be contrary to the public interest e.g. by identifying a specific harm to the public interest flowing from release.
There is nothing in the exemption itself which requires the deliberative process to be ongoing but this issue may be relevant to the issue of the public interest. The Commissioner has found that the Act clearly envisaged that there will be cases in which disclosure of the details of an FOI body’s deliberations - whether before or, in some cases, after a decision based on those deliberations has been made - would be against the public interest. However, this was not to say that such disclosure is always, as a matter of principle, against the public interest.
Section 29(1)(a) - deliberative processes
The Department says that the 2022 Act was an emergency legislative response to the 2022 CJEU ruling. It says that its officials have continued to consider potential policy options on data retention, to ensure a fit-for-purpose regime which addresses technological developments whilst also meeting the requirements of CJEU case law. It says that these policy proposals will inform the drafting of new legislation to replace the 2011 Act. It says that no decision has been made on the nature or timing of future public consultation on the matter. It says that it took an EU Commission expert group two years to publish a roadmap on lawful access, which it says highlights the legal, technological, and operational complexities around lawful access and data retention. Its position is that the records disclose legislative issues and positions that are under deliberation in relation to these matters.
I have not received any arguments from the applicant in relation to section 29(1)(a).
Analysis
I have considered the content of the relevant records and the Department’s arguments. I am satisfied that the records consider various issues relating to the development of policy and legislation, which I accept is a deliberative process. I find that the first requirement of section 29(1), as set out at section 29(1)(a) of the FOI Act, has been met.
Section 29(1)(b) – contrary to the public interest
The applicant says that there is a significant public interest in relation to this topic. While this may be the case, section 29(1)(b) does not require me to consider whether the weight of the public interest favouring disclosure of the records is greater than the weight of the public interest favouring the withholding of the records. Rather, it requires that disclosure “would be contrary to the public interest”.
I accept that the process of choosing the most appropriate policy to adopt regarding potential changes to the relevant legislation is complex. In my view, the Department needs appropriate time and space to deliberate and decide on this matter, and that the public interest would not be served by any action that might hinder the Department’s deliberative processes. I am not implying that the applicant would cause such interference. Rather, my comments reflect that the release of records under FOI is equivalent to their publication to the world at large.
Further to the above, I accept that disclosure of the records would be contrary to the public interest. I find that the second requirement of section 29(1), as set out at section 29(1)(b) of the FOI Act, has been met.
Accordingly, I find that section 29(1) applies to the remainder of record 1, and records 11, 14, 15, 17 and 18 in full.
Section 29(2) – exceptions
Section 29(2) provides that subsection (1) does not apply to a record if and in so far as it contains any or all of the following:
(a) matter such as rules, procedures, guidelines, interpretations and precedents used, or intended to be used, by an FOI body for the purpose of making decisions, determinations or recommendations;
(b) factual information;
(c) the reasons for the making of a decision by an FOI body;
(d) a report of an investigation or analysis of the performance, efficiency or effectiveness of an FOI body in relation to the functions generally or a particular function of the body;
(e) a report, study or analysis of a scientific or technical expert relating to the subject of his or her expertise or a report containing opinions or advice of such an expert and not being a report used or commissioned for the purposes of a decision of an FOI body made pursuant to any enactment or scheme.
The Department has not addressed section 29(2). I have not received any arguments from the applicant in relation the matter.
Having examined the records, I am satisfied that the remainder of record 1 and record 18 do not contain factual information for the purposes of section 29(2)(b). Rather, they consist of issues for discussion, draft material and observations. I accept that records 11, 14, 15, and 17 contain some factual information. However, it is relevant that the factual information is in many instances inextricably linked to other types of information such as analysis, opinions, etc. I have already outlined the provisions of section 18 of the FOI Act and the Commissioner’s approach to the matter. In my view, it would not be practicable to attempt to extract any factual information from these records while at the same time ensuring that the redacted copies are not misleading under section 18 of the Act. I find that section 29(2)(b) does not apply.
I am also satisfied that none of the other provisions of section 29(2) apply in this case.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the Department’s decision. I find that the remaining withheld details are exempt under sections 29(1), 32(1)(a)(i) and 33(3)(c)(i) of the FOI Act.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Anne Lyons
Investigator